Social media profiles leaked: what it means and what to do

Risk level: medium. Can you change it: yes. Found in 50 breaches in this directory.

What this data is

Usernames, profile URLs or handles for social networks such as Facebook, Instagram, X, TikTok, LinkedIn or Discord, stored alongside another account.

The risk on its own

A profile link may already be public, but a leak connects it to the breached account and its data. It gives attackers a direct path to your photos, friends, location clues and posts. If an account was meant to be anonymous, the link can expose your identity.

The risk combined with other data

With your email address, phone number and name, social profile links make it easy to build a full picture of your life. Attackers can use public posts to guess security answers, craft phishing messages or impersonate you. They can also target the social accounts themselves for takeover.

How criminals use it

  • An attacker reads your public posts to answer security questions such as your pet's name.
  • Your social profile is copied to create a fake account that messages your followers.
  • An anonymous account is linked to your real name through a profile URL stored in the breach.
  • Phishing messages pretend to be from the social network about a copyright or verification problem.

What to do now

  1. Review each linked account's privacy settings and limit posts, friends and personal details to people you trust.
  2. Turn on two-factor authentication and check logged in devices for each social account.
  3. Remove links between anonymous accounts and your real profiles.
  4. Search for impersonation accounts and report them to the platform.
  5. Delete social accounts you no longer use.

Frequently asked questions

My profiles are public. Is this leak a problem?

It is less serious than a password leak, but it links your public profiles to other breached data, making targeting easier.

Can someone hack my social media with just the profile link?

No. They still need your login details or a successful phishing attempt. Protect the account with two-factor authentication.

Should I make my profiles private?

Consider it, or at least hide your friends list, location, birthday and old posts.

Breaches that exposed this data

  • Data Enrichment Exposure From PDL Customer: 2019-10-16, 622M accounts, Email addresses, Employers, Geographic locations, Job titles, Names, Phone numbers
  • Wattpad: 2020-06-29, 269M accounts, Bios, Dates of birth, Email addresses, Genders, Geographic locations, IP addresses
  • Twitter (200M): 2021-01-01, 212M accounts, Email addresses, Names, Social media profiles, Usernames
  • Apollo: 2018-07-23, 126M accounts, Email addresses, Employers, Geographic locations, Job titles, Names, Phone numbers
  • LinkedIn Scraped Data (2021): 2021-04-08, 126M accounts, Education levels, Email addresses, Genders, Geographic locations, Job titles, Names
  • DemandScience by Pure Incubation: 2024-02-28, 122M accounts, Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses
  • You've Been Scraped: 2018-10-05, 66M accounts, Email addresses, Employers, Geographic locations, Job titles, Names, Social media profiles
  • Houzz: 2018-05-23, 49M accounts, Email addresses, Geographic locations, IP addresses, Names, Passwords, Social media profiles
  • piZap: 2017-12-07, 42M accounts, Email addresses, Genders, Geographic locations, Names, Passwords, Social media profiles
  • Mathway: 2020-01-13, 26M accounts, Device information, Email addresses, Names, Passwords, Social media profiles
  • Mangatoon: 2022-05-13, 23M accounts, Auth tokens, Avatars, Email addresses, Genders, Names, Passwords
  • Covve: 2020-02-20, 23M accounts, Email addresses, Job titles, Names, Phone numbers, Physical addresses, Social media profiles

Tools that help

Related guides

Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.